Overview

overview

10

Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4296-31-0x0000000003F40000-0x00000000040D5000-memory.dmp

  • Size

    1.6MB

  • MD5

    b0257ddcfa8cc9b4359f259f0f79c0d9

  • SHA1

    60ae7da0b99063dc372db790dd8e3d749d16bfb6

  • SHA256

    e84292e0f020fc4cc8a4b056a9fd1e153d7caca04510c63b2f424bc4ca737e44

  • SHA512

    c1dd006e5149fb230a6c45f37f6899193cc9d698c6a3f700c20a4f28a45444dbb44002230efd788b36147a29f9560bc111195172c3e090d09662c89c7baf3717

  • SSDEEP

    6144:xRi16KStoUBdz6sXNfmeRwfW80dqBDnn3NCADvDIxdFH+sa0qD5:xg16v9z6UfmeRwfW80dqBrDvgfH+saj

Score
10/10
ads5darkgate

Malware Config

Extracted

Family

darkgate

Botnet

ADS5

C2

http://siliconerumble.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    443

  • check_disk

    true

  • check_ram

    true

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    zSfdFmnnAquXKs

  • internal_mutex

    txtMut

  • minimum_disk

    32

  • minimum_ram

    6003

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    ADS5

Signatures

Files

  • 4296-31-0x0000000003F40000-0x00000000040D5000-memory.dmp